Resolving MB_CLIENT ID Confusion: S7-1200 to ATV630 Modbus TCP

Problem Overview

Engineers commissioning a SIMATIC S7-1200 CPU (firmware V4.0 or higher) as a Modbus TCP client frequently report that the MB_CLIENT instruction freezes, returns error code 0x0001 (protocol error) or stays in BUSY=1 indefinitely when the Modbus Unit ID of the target server is 0. The most common case in the field is a Schneider Electric Altivar Process ATV630 / ATV660 / ATV680 / ATV6xx drive, which is shipped with Modbus Unit ID (a.k.a. Slave Address) = 0 in its COMM menu, and the user mistakenly believes this value cannot be changed.

The real cause is a conceptual collision between two distinct identifiers:

• MB_CLIENT Connection ID – a local, in-PLC reference number (Word, range 1..65535 in modern TIA Portal versions, historically 1..4095) used to differentiate multiple active TCP connections inside the S7-1200 program.
• Modbus Unit Identifier (formerly Slave Address, MBAP field) – the protocol-level address of the target device on the Modbus bus, range 0..247 for serial, 0..255 for Modbus TCP (only 0..247 have a defined meaning in the Modbus Application Protocol Specification).

These two IDs are independent. A valid MB_CLIENT configuration must supply both, and Unit ID = 0 is perfectly valid for Modbus TCP because the MBAP Unit Identifier is largely used to identify a sub-device on a serial segment behind a Modbus TCP/Modbus RTU gateway – on a pure Modbus TCP link, the value is ignored or echoed back by IP-addressed devices.

Root Cause: ID Confusion, Not Protocol Limitation

According to the Siemens SIMATIC S7-1200 Programmable Controller – Communication Processor and Modbus TCP manual (entry ID 109741593), “each MB_CLIENT connection must assign a unique connection ID; unique IP port numbers may or may not be required depending upon the server configuration.” The ID input on the FB is therefore a project-scoped reference, not a Modbus protocol field. It is the symbolic handle you give to the connection in your user program and in the instance DB.

The MB_UNIT_ID input on the same block is the value placed into the Modbus Application Protocol (MBAP) header, byte 6, and reaches the target drive. If the ATV630 is configured to ignore Unit ID (the AdIP = 0 default on Ethernet) it will still answer the request. Therefore the perceived freeze at ID = 0 is almost always caused by one of the following:

1. The drive is not in Modbus TCP mode – the embedded Ethernet port is still set to Ethernet IP or is in a state where it does not open port 502.
2. The drive IP address / subnet does not match the S7-1200 interface, so the TCP open succeeds with a 3-second timeout and the block sits in WAIT_FOR_CONNECTION.
3. The Unit ID of the drive has been changed by the user (e.g. 1) but the MB_UNIT_ID input on the FB was left at 0, or vice-versa.
4. The user wrote 0 to the FB's ID input (a connection ID) and the SCL/ST compile accepts it but the runtime rejects it because ID = 0 is reserved as “no connection”.

Technical Details: MB_CLIENT Inputs

The following parameter map is from the SIMATIC S7-1200 manual collection – MB_CLIENT instruction:

Solution: Correct ID Configuration for S7-1200 → ATV630

To read data from an ATV630 (firmware ≥ V1.6 for full Modbus TCP support) on an S7-1200 (CPU 1214C DC/DC/DC, firmware V4.4 used for this example) carry out the steps below.

Prerequisites

• ATV630 with embedded Ethernet port (or VW3A3600 module). Modbus TCP enabled in Menu > Communication > Ethernet > Protocol – must show Modbus TCP, not EtherNet/IP.
• Drive's IP address known (default 192.168.1.4), subnet mask 255.255.255.0.
• S7-1200 CPU with at least one PROFINET interface configured, firmware V4.0 or higher (T-CONNECT block requires V4.0).
• TIA Portal V16 or higher, with “S7-1200 Motion / Communication blocks” installed.

Step 1 – Enable Modbus TCP on the ATV630

1. Power up the drive, enter the main menu with the jog wheel.
2. Navigate: 5 - COMMUNICATION > 1 - Ethernet > 1 - Protocol – select Modbus TCP.
3. Navigate: 5 - COMMUNICATION > 1 - Ethernet > 3 - Modbus Unit ID – set to any value 1..247. The default 0 is legal for Modbus TCP but most installation guides (including the Schneider Altivar Process 630 Modbus manual EAV64300) recommend 1 to mirror the serial line.
4. Confirm with OK and cycle control power if prompted.

Step 2 – Create the Connection DB in TIA Portal

Create a global DB named MB_Atv630_Conn with the following structure (matches the TCON_IP_v4 UDT):

DATA_BLOCK "MB_Atv630_Conn"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
   STRUCT
      InterfaceId      : HW_ANY := 64;          // 64 = PN interface of CPU
      Id               : WORD  := 1;            // TCON connection ID 1
      ConnectionType   : BYTE  := 16#0B;        // 11 = TCP native
      ActiveEstablished : BOOL := TRUE;         // client is active
      RemoteAddress    : IP_V4 := 192.168.1.4;  // ATV630 IP
      RemotePort       : UINT  := 502;
      LocalPort        : UINT  := 0;            // 0 = any
   END_STRUCT;
END_DATA_BLOCK

Step 3 – Instantiate MB_CLIENT and Poll Holding Registers

The next network reads 8 words from the ATV630 (status word, output frequency, motor current, motor torque, drive thermal state, DC bus voltage, drive state, last fault code). The standard Modbus address range used in the ATV630 Modbus manual (EAV64300) is:

Note: ATV630 manual registers are written as logical addresses starting at 1. The Modbus protocol uses zero-based addressing, so the S7-1200 must use the value minus one: 3201 - 1 = 3200. The above is the Siemens convention used in their official Modbus TCP example projects.

// SCL example – one-shot poll, period 100 ms via cyclic OB1
IF "Clock_100ms" AND NOT "MB_CLIENT_DB".BUSY AND NOT "MB_CLIENT_DB".ERROR THEN
   "MB_CLIENT_DB".REQ        := TRUE;
   "MB_CLIENT_DB".ID         := 1;            // local connection ID, NOT the Modbus Unit ID
   "MB_CLIENT_DB".CONNECT    := "MB_Atv630_Conn";
   "MB_CLIENT_DB".MB_MODE    := 0;            // 0 = FC03 Read Holding
   "MB_CLIENT_DB".MB_DATA_ADDR := 3200;       // register 3201 (Status Word) - 1
   "MB_CLIENT_DB".MB_DATA_LEN := 8;           // 8 words = 16 bytes
   "MB_CLIENT_DB".MB_UNIT_ID := 1;            // matches ATV630 Unit ID
   "MB_CLIENT_DB".DATA_PTR   := P#DB100.DBX0.0 BYTE 16;
   // DATA_PTR points to 16 bytes; 8 words will be returned.
ELSE
   "MB_CLIENT_DB".REQ        := FALSE;
END_IF;

Map the read words from DB100 symbolically in the user program. For example DB100.DBW0 = ETA (Status Word), DB100.DBW2 = RFRD (output speed in rpm), etc.

Step 4 – Verify the Connection

1. Compile and download the project to the CPU.
2. Open Online & Diagnostics > Watch table on DB100 – within 100 ms the values should start to update.
3. Read MB_CLIENT_DB.STATUS and compare to the Siemens error code table:

Troubleshooting Matrix

Why Connection ID 1..4095 Is Mandatory

The S7-1200 firmware uses the ID field of the TCON_IP_v4 UDT as a key into the internal connection management table (CMT). The CMT has 16 (V13/14) or up to 64 (V15.1+) entries. Each MB_CLIENT instance must reserve one of these entries, and the reservation is identified by the ID you write into the TCON_IP_v4 structure. ID = 0 is treated internally as “free slot” and the FB rejects it. Two FB instances using the same ID will silently override each other – you will see responses intended for FB1 delivered to FB2, with the classic symptom of “sometimes works, sometimes freezes”.

Best practice: assign IDs in a project-wide constant block (e.g. MBID_ATV630 := 1, MBID_PM5000 := 2, …) to prevent duplicates. This is also the recommendation in the Siemens FAQ 109741593.

Advanced: Polling Multiple ATV630 Drives

For more than one drive on the same subnet, instantiate one MB_CLIENT per drive, each with:

• Its own ID (1, 2, 3, …)
• Its own DATA_PTR to a per-drive DB
• Its own TCON_IP_v4 (or shared if you wish to reconnect dynamically, but a permanent per-drive connection is recommended)
• Its own MB_UNIT_ID matching the slave address configured in the drive

Drive the REQ inputs from a sequencer FB (e.g. a 100-ms cyclic time-slice scheduler) to avoid concurrent transactions. Trying to fire more than one MB_CLIENT with the same ID while BUSY=1 returns STATUS = 0x7001 with no effect.

Cross-Vendor Notes

The same code pattern works against any Modbus TCP server: Schneider PowerLogic PM5000, ABB M4M, Eaton Power Xpert, ABB ACH580 drives, Danfoss FC 302, etc. Adjust the MB_DATA_ADDR and the unit ID according to the vendor manual. The Schneider PowerLogic PM5000 register map is published in the PowerLogic PM5000 series user manual; ABB drives follow the Common Industrial Protocol Drive Profile (CiA 402) – registers 0x2000 (control) and 0x2001 (speed reference) for ABB ACH580 in Modbus TCP mode.

Safety and Commissioning Caveats

During commissioning, force the control word (CMD, register 8501) to 0x0000 and the speed reference (LFRD, register 8502) to 0 until the wire-up is verified. Use Trace on the drive to log ETA (status word) – a value of 0x0237 (Ready, Run command, Quick stop inactive, No fault) confirms a healthy handshake.

Verification Checklist

1. MB_CLIENT_DB.BUSY toggles to 0 within 100 ms of REQ := TRUE.
2. MB_CLIENT_DB.DONE is 1 for one scan after each successful transaction.
3. MB_CLIENT_DB.ERROR stays 0 for ≥ 1000 transactions.
4. DB100 first word (ETA) is non-zero when the drive is in Ready state (typical 0x0637).
5. DB100 second word (RFRD) updates within 200 ms when the drive is started via the local HMI.
6. Disconnect the Ethernet cable – STATUS = 0x80D2 after 3 s, ERROR = 1, then re-connects within 10 s when the cable is plugged back in.

FAQ